Example report · sample data for a fictional app. Not a real customer.
What you get from Cheqvo
Each issue found, in plain English, how serious it is, and a prompt you can paste into Cursor, Lovable or Bolt to fix it.
Cheqvo Full Report · Exampleexample/acme-saas148 files scanned
Score
41/100
Serious issues found
Findings by severity · 5 total
Critical1
High2
Medium1
Low1
CriticalSecretsFinding 01
Stripe secret key in a frontend file
src/lib/stripe.ts:4
What it is
A live Stripe secret key is hard-coded in code that ships to the browser.
Why it matters
Anyone can open DevTools, copy it, and issue refunds or read your customers.
What to do
Rotate the key in Stripe, move it to a server-only env var, and call Stripe only from an API route.
Severity
Critical:
Fix prompt · paste into Cursor, Lovable or Bolt
In src/lib/stripe.ts a Stripe secret key (sk_live_...) is hard-coded and bundled into the client. Remove it from the code. Read it from process.env.STRIPE_SECRET_KEY instead, and only use it in server-side code (an API route or server action), never in a file imported by a client component. Move any client code that called Stripe directly to call a new /api route. Add .env* to .gitignore. Do not change any other behavior. After the change, list every file you edited.
HighDatabaseFinding 02
Supabase table "orders" has Row Level Security off
supabase/migrations/0001_init.sql:12
What it is
Your database lets anyone with the public anon key read and edit this table.
Why it matters
The anon key ships in your frontend, so every visitor can see every order.
What to do
Turn on RLS and add a policy so users only see their own rows.
Severity
High:
Fix prompt · paste into Cursor, Lovable or Bolt
In my Supabase project the table public.orders has Row Level Security disabled. Write a new migration that runs: alter table public.orders enable row level security; then add select, insert, update and delete policies that only allow rows where auth.uid() = user_id. If the table has no user_id column, tell me before changing anything. Do not modify other tables.
HighSecurityFinding 03
API route /api/admin/users has no auth check
app/api/admin/users/route.ts:1
What it is
This route returns all users and does not check who is calling it.
Why it matters
Anyone who guesses the URL gets your full user list.
What to do
Check the session at the top of the handler and return 401 unless the user is an admin.
Severity
High:
Fix prompt · paste into Cursor, Lovable or Bolt
The route app/api/admin/users/route.ts returns user data without checking authentication. At the top of each handler, get the current user from the session (use the auth library already in this project). Return a 401 JSON response if there is no user, and 403 if the user is not an admin. Keep the existing response shape for authorized callers.
MediumSecurityFinding 04
No Content-Security-Policy header
next.config.js
What it is
Your site does not tell browsers which scripts are allowed to run.
Why it matters
If an attacker injects a script, nothing stops the browser from running it.
What to do
Add a basic CSP header and tighten it over time.
Severity
Medium:
Fix prompt · paste into Cursor, Lovable or Bolt
Add security headers to next.config.js using the headers() function: Content-Security-Policy (start with default-src 'self' and allow only the third-party domains this app already loads), X-Content-Type-Options: nosniff, Referrer-Policy: strict-origin-when-cross-origin. List the external domains you found so I can confirm them.
LowLaunch basicsFinding 05
No lockfile committed
package.json
What it is
Installs can pull different package versions each time.
Why it matters
Your app may break on deploy with no code change.
What to do
Run npm install and commit package-lock.json.
Severity
Low:
Fix prompt · paste into Cursor, Lovable or Bolt
This repo has a package.json but no lockfile. Run npm install to generate package-lock.json, make sure it is not in .gitignore, and commit it. Do not upgrade any dependencies.